Canada’s anti-spam law is facing a fresh wave of criticism from long-time opponents as the third anniversary of its proclamation approaches.
This year, CASL’s birthday on July 1 not only kicks off the statutory three-year Parliamentary review baked into the law, it also coincides with the coming into force of its private right of action provisions, which allow individuals and organizations to take legal action themselves against spammers.
The eye-watering level of potential damages — the law allows courts to award $200 per violation, up to a maximum $1 million per day — are the stuff of dreams for class actions lawyers and of nightmares for businesses that engage in online marketing.
Toronto competition lawyer Steve Szentesi says many of his clients have wanted CASL repealed since the day it entered the statute books.
And while that goal may be unrealistic, he says, the mandatory review presents a good chance to clear up the uncertainties that remain.
“The government needs to simplify and streamline the law and make it more intelligible for businesses so that they can actually apply it in practice,” Szentesi says. “The government can still achieve consumer protection while making it more user-friendly.”
Hans Parmar, a spokesman for Innovation, Science and Economic Development Canada, said in a statement to Law Times that his ministry, which is responsible for the regulations governing CASL’s enforcement, is under pressure from several corners of industry.
“Various businesses and technology associations have expressed concern with the private right of action and some have suggested delaying its coming into force until after CASL’s three-year statutory review, due in 2017,” Parmar said.
“We have reached out to stakeholders for their views on this and are actively reviewing how best to support consumer trust in the online market, while not unduly burdening legitimate business,” he added.
One of the groups to throw in its two cents was the Canadian Bar Association.
Three of its sections, representing in-house, competition and privacy lawyers, teamed up in February to urge the ministry in a letter to hold off on the launch of the private right of action, claiming the mandatory review would allow the government an opportunity to reassess its appropriateness “in the context of CASL as a whole.”
“Any areas of concern could then be addressed — through legislative amendments following the review or other means — reducing unnecessary risk to organizations acting in good faith,” the CBA letter added.
Canada was initially slow out of the blocks on the anti-spam front. When CASL finally cleared Parliament in December 2010, the country became the last G-7 nation to enact legislation on the issue.
However, it made up for lost time with one of the strictest regimes the world has seen, since the act prohibits all unsolicited commercial electronic messages unless the recipient has given explicit or implied consent to receive them.
Although it sounds like a simple concept, Szentesi says, lawyers advising clients on compliance for specific marketing activities or campaigns need to go through reams of regulations and interpretations issued by the three federal agencies responsible for enforcing the act: the Canadian Radio-television and Telecommunications Commission, the Competition Bureau and the Office of the Privacy Commissioner of Canada.
“The law is supposed to be technologically neutral, but it’s a constant challenge to understand how it applies to new media and social media platforms for businesses that are pushing digital marketing boundaries,” Szentesi says.
“The result is a chilling effect that is affecting competitiveness for companies that are worried about technical violations and fearful of enforcement.”
Hopes for a light-touch approach in the early days of CASL enforcement were quickly dispelled when the CRTC announced its first action in early 2015: issuing a $1.1-million fine to Compu-Finder.
The CRTC found the Quebec-based management training company had committed four CASL violations in emails sent without consent and without a working unsubscribe function to addresses found by scouring websites. Since then, online dating agency Plentyoffish Media and food company Kellogg Canada are among the higher-profile companies to have paid fines for CASL offences.
Late in 2016, the CRTC issued its first decision in a contested case, where the accused violator challenged the findings of an investigation.
Blackstone Learning Corp. was initially handed a monetary penalty of $640,000 for alleged violations in nine marketing campaigns where the company sent a total of nearly 400,000 promotional emails, which resulted in 60 complaints.
After demonstrating that such a large fine risked killing the business, as well as a commitment to future compliance, the penalty was reduced to $50,000.
“It was a notable decision, because it shows that you can fight these penalties and achieve quite a good result,” says Kelly Friedman, a litigation partner in the Toronto office of DLA Piper Canada LLP.
The second decision, issued in March this year, attracted interest for different reasons, according to Friedman.
“A lot of the public cases so far have involved some larger companies, but this one is the first time we have seen the CRTC going after an individual,” she says.
This time, the CRTC upheld its initial penalty assessment, imposing a $15,000 fine on William Rapanos for 10 CASL violations stemming from 58 emails sent to advertise his flyer design and delivery business. “That’s a lot of money for not a lot of spam activity,” Szentesi says.
“It’s sobering for small businesses, because it highlights the genuine concern that if you make missteps you could be exposed to significant penalties.”
But John Lawford, the executive director and general counsel of the Public Interest Advocacy Centre, has little sympathy for CASL violators.
“If you’re still sending emails with no unsubscribe function, you need to catch up because this is old stuff now. And if you’re blasting out emails to a list of people you have no relationship to at all, then you deserve to get a fine,” he says.
“It’s hard to prove a negative, but I think the law has resulted in a lot less spam.”
Lawford also believes the outcry over the launch of the private right of action has been overblown. “Everyone is freaking out, but I think it’s more likely to be used against the hardcore spammers, where there’s a fraudulent aspect to it,” he says.
Friedman says predictions of an avalanche of class action activity after July 1 may also prove unfounded, since the private right of action provisions bar claims for the lucrative statutory damages in cases where the CRTC has already taken regulatory action.
Any action must then show actual damages suffered by individuals as a result of receiving spam. “Class action lawyers are really creative, as I know from my experience acting for defendants responding to their claims,” she says. “I have no doubt we will see some actions, but I can’t imagine the financial damage a person can suffer to make these lawsuits worthwhile for class counsel to take on. It will be interesting to see how it plays out.”
Jonathan Bitran, a lawyer with McCarthy Tétrault LLP, says the private right of action also interferes with the traditional framework of the Competition Act by allowing private citizens to sue for non-criminal breaches of the law. “Previously, it had to be the commissioner of competition who took action in civil matters,” he says.
In addition, Bitran says, the lack of a mens rea provision or materiality requirement in sections dealing with false or misleading representations could put companies at risk of lawsuits for innocent or minor misrepresentations in emails.
“The concern is that a lot of legitimate businesses could get caught up in actions that will not result in any benefit to society,” he says.
